Amazon S3 is the original object storage, and Dropbucket works with it directly. If your agency already runs on AWS, keeping client files in your own account can make billing and compliance simpler.

One thing to plan for: AWS charges for data transferred out to the internet, so large downloads cost more than on providers with free or included egress. Check the S3 pricing page for your region.

This guide takes about fifteen minutes, most of it in IAM.

What you need

  • An AWS account with permission to create S3 buckets and IAM users.
  • A Dropbucket account. The free plan works with Amazon S3.

Step 1: Create a bucket

  1. Open the S3 console and choose Create bucket.
  2. Pick an AWS Region close to you and your clients. Note it, for example ap-southeast-2 (Sydney).
  3. Enter a bucket name. Use lowercase letters, numbers and dashes, for example agency-transfers. Avoid dots: they cause certificate errors with the default URL style.
  4. Leave Block all public access turned on. Dropbucket uses short-lived signed links, so the bucket stays private.
  5. Leave the other settings at their defaults and choose Create bucket.

Step 2: Create a least-privilege policy

Dropbucket needs to read, write and delete objects, run multipart uploads, and (optionally) set the bucket’s CORS rule. Nothing else, and only on this bucket.

  1. Open the IAM console and go to Policies → Create policy.
  2. Switch the editor to JSON and paste the policy below. Replace agency-transfers with your bucket name in both places.
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DropbucketBucket",
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket",
        "s3:GetBucketCORS",
        "s3:PutBucketCORS"
      ],
      "Resource": "arn:aws:s3:::agency-transfers"
    },
    {
      "Sid": "DropbucketObjects",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject",
        "s3:DeleteObject",
        "s3:AbortMultipartUpload",
        "s3:ListMultipartUploadParts"
      ],
      "Resource": "arn:aws:s3:::agency-transfers/*"
    }
  ]
}
  1. Name it dropbucket-agency-transfers and create it.

What each part does:

  • s3:PutObject covers normal uploads and the steps of a multipart upload (start, upload part, complete).
  • s3:ListMultipartUploadParts lets an interrupted upload resume from the parts already in the bucket.
  • s3:AbortMultipartUpload cleans up a cancelled upload so you’re not billed for leftover parts.
  • s3:ListBucket lets S3 answer “not found” properly instead of “access denied” when a file is missing.
  • s3:GetBucketCORS and s3:PutBucketCORS let Dropbucket add its browser-upload rule for you. If you’d rather paste the rule yourself (Step 4), you can remove these two.

Step 3: Create an IAM user and access key

  1. In IAM, go to Users → Create user. Name it dropbucket. Don’t give it console access.
  2. On the permissions step, choose Attach policies directly and tick the policy from Step 2.
  3. Create the user.
  4. Open the user, go to the Security credentials tab and choose Create access key.
  5. For the use case, pick Third-party service (or Application running outside AWS). Confirm and create.

AWS shows an Access key and a Secret access key. Copy both, or download the .csv file. The secret is shown once only.

The exact menu may differ slightly as AWS updates its console.

Step 4: CORS (usually automatic)

Files travel from your client’s browser straight into S3. The browser only allows that if the bucket has a CORS rule that permits Dropbucket’s pages.

With the policy above, Dropbucket adds the rule itself when you save. If you removed the CORS actions, add it by hand:

  1. In the S3 console, open the bucket and go to the Permissions tab.
  2. Under Cross-origin resource sharing (CORS), choose Edit.
  3. Paste this rule and save:
[
  {
    "AllowedOrigins": [
      "https://app.dropbucket.io"
    ],
    "AllowedMethods": [
      "GET",
      "PUT",
      "HEAD"
    ],
    "AllowedHeaders": [
      "*"
    ],
    "ExposeHeaders": [
      "ETag"
    ],
    "MaxAgeSeconds": 3600
  }
]

If you use your own domain for download and upload pages, add it as a second origin, such as "https://files.youragency.com". See Put your download pages on your own domain. The Storage page in Dropbucket shows this rule with your verified domains already filled in.

Step 5: Connect S3 in Dropbucket

  1. In Dropbucket, go to Settings → Storage.
  2. Under Provider, choose Amazon S3.
  3. Endpoint: https://s3.<REGION>.amazonaws.com with your region, for example https://s3.ap-southeast-2.amazonaws.com.
  4. Bucket: the bucket name.
  5. Region: the same region code, for example ap-southeast-2.
  6. Access key ID and Secret access key: from Step 3.
  7. Folder inside the bucket (optional): leave blank, or enter a folder name like client-files.
  8. Leave Path-style URLs unticked. That’s the right setting for AWS.

Test the connection

Press Test and save.

Dropbucket writes a tiny test file, reads it back and deletes it. When that works, the Status card shows a tick next to Keys work. It then sets the CORS rule and runs a real upload from your browser. When Browser uploads allowed (CORS) shows a tick, you’re done.

If the CORS step shows “We couldn’t set this automatically on your provider”, paste the rule as in Step 4, then press Check again.

Troubleshooting

“The storage provider refused these keys.” Check the key and secret were copied in full. Check the policy is attached to the user and that the bucket name in both Resource lines is correct. The bucket line has no /*. The objects line does.

“Wrong region or endpoint for this bucket.” The endpoint or Region doesn’t match the bucket’s region. S3 redirects requests sent to the wrong region, and Dropbucket reports that as this error.

“That bucket was not found at this endpoint.” Check the spelling of the bucket name.

Certificate or connection errors with a dotted bucket name. Names like files.agency.com break the default (virtual-hosted) URL style over HTTPS. Use a bucket name without dots, or tick Path-style URLs.

Keys work, but the CORS check fails. The rule is missing or the origin has a typo. It must be exactly https://app.dropbucket.io, with no trailing slash.

Uploads fail with 403. Usually CORS. If CORS passes, check the bucket uses default encryption (SSE-S3). If it uses a KMS key (SSE-KMS), the IAM user also needs kms:GenerateDataKey and kms:Decrypt on that key.

“Your storage didn’t return an ETag.” Your CORS rule is missing ETag under ExposeHeaders. Add it back.

Next steps

Add your logo under Settings → Branding, then send a transfer or create a request link so clients can upload straight into S3.

Ready to try it? Create a free Dropbucket account and connect your bucket.